Quoting "Tony L. Svanstrom" <[EMAIL PROTECTED]>:
> On Sat, 6 Jul 2002 the voices made Patrice Fournier write:
>
> > body LOCAL_LONG_WORD /[a-zA-Z]{90}/
> > describe LOCAL_LONG_WORD LOCAL: Long random word in body (90
> chars+)
> > score LOCAL_LONG_WORD 4.8
>
> Why 90? Wouldn't it work better with 50 or 60, so that it catches
> ID-strings; or atleast ignore linebreaks and include numbers?! Hmmm...
> well, I guess it could start matching on encoded/asciiarmored messages
> then, but, really, does this one really work well?
It does catches spam with the 120 or so random letters at the end. And as
you said, I didn't want it to match on any encoded messages so that I
could give it a high score. Just yesterday, it helped a mortgage spam get
over my treshold of 7 (it scored 6.something without my local rules). I
don't receive that much spam though and this one I added just a week or
two ago; that's why I was wondering where we could test them against the
corpus (which would also test against kind of messages I don't have here).
It also matched a spam message that used a long line of xoxoxoxoxox in
html format at the end of the message. This is the kind of input I'm
trying to see if it appears in real messages. Maybe the rule could be
changed to check for more than 2 different letters, but would that be
enough?
Btw, this same message did use a new formulation to ask for removal:
If you wish to be "eliminated" -from our - l-i- s-t,<BR>
ple ase email [EMAIL PROTECTED]<BR>
which didn't match any list removal rules. I don't know if this format is
a one time form or not, but maybe it could be added to the rules. Now, I
don't have any more messages using a rule similar to this one so I don't
know if the spacing is always at the same place or if any word can have
spaces inside it or dashes added to obfuscate them from spam catching
software... Maybe "/if you wish to be \"?eliminated\"?/i" would be enough
to not trigger false positives and yet catch most or all of those
formulations. Anyone else has any such formulations to share?
Thanks for your input,
--
Patrice Fournier
[EMAIL PROTECTED]
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
We have stuff for geeks like you.
http://thinkgeek.com/sf
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
